The libpng library in Red Hat Enterprise Linux 8 contains three distinct security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could potentially be exploited to cause denial of service or leak information. Red Hat has issued an important security advisory (RHSA-2026:4728) with updated libpng packages to remediate these issues.

The vulnerabilities in libpng can lead to information disclosure and denial of service conditions. Specifically, integer truncation and heap buffer over-read issues may allow attackers to read sensitive memory contents or crash affected applications. The heap buffer overflow could lead to application crashes or potentially more severe impacts if exploited. These issues affect systems running Red Hat Enterprise Linux 8 with the vulnerable libpng versions.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4728 and the referenced article https://access.redhat.com/articles/11258. Applying this official update will remediate the security issues. No additional mitigation steps are indicated by the vendor advisory.